# Core FastAPI framework and server
# FastAPI: Modern, fast web framework for building APIs
# Latest: 0.123.9 (Dec 4, 2025) - No known CVEs
fastapi>=0.123,<0.124

# ASGI server for running FastAPI
# Latest: 0.38.0 (Oct 18, 2025) - No known CVEs
# Note: Old versions had CVE-2020-7694/7695, but 0.38.0 is secure
uvicorn[standard]>=0.38,<0.39

# Additional dependencies
# Pydantic for data validation (comes with pydantic-ai but pinning explicitly)
# Updated to >=2.11 due to ag-ui-protocol dependency requirement
# Latest: 2.12.4 (Nov 5, 2025) - No known CVEs
pydantic>=2.11,<2.13

# AI/LLM integration
# PydanticAI: Agent framework for using Pydantic with LLMs
# Using slim version with only openai extra (Ollama uses OpenAI-compatible API)
# This avoids installing SDKs for anthropic, cohere, google, groq, huggingface, etc.
# See DEPENDENCY_SLIM.md for rollback instructions if this breaks
pydantic-ai-slim[openai]>=1.27,<1.28

# HTTP client for Ollama communication
# Latest: 0.28.1 - No known CVEs
httpx>=0.28,<0.29

# Server-Sent Events for streaming responses
# Required for OpenAI-compatible streaming endpoints
# Latest: 3.0.2 (Oct 30, 2025) - No known CVEs
sse-starlette>=3.0,<3.1

# Configuration management
# Latest: 1.2.1 (Oct 26, 2025) - No known CVEs
python-dotenv>=1.2,<1.3

# ASGI toolkit (dependency of FastAPI, pinning for security)
starlette>=0.45,<0.46

# Redis for performance benchmarking and caching
# Latest: 5.2.1 (Dec 5, 2025) - No known CVEs
# hiredis: C parser for better performance
redis[hiredis]>=5.2,<6.0

# Qdrant vector database client for memory storage
# Latest: 1.12.1 (Dec 2025) - No known CVEs
qdrant-client>=1.12,<2.0

# Structured logging for observability
# Latest: 24.4.0 (Aug 22, 2024) - No known CVEs
structlog>=24.1,<25.0

# Note on version locking strategy:
# Using >=X.Y,<X.(Y+1) format to lock to minor versions
# This protects against supply chain attacks while allowing patch updates
# Update regularly and review changelogs before upgrading minor versions